ProSolution WP Client Plugin Unauthenticated Arbitrary File Upload RCE

Technical Analysis

CVE-2026-16098 (CVSS 9.8) stems from the proSol_handleFileUpload function failing to validate the attacker-controlled Content-Disposition header filename, which overrides the intended allow-listed multipart filename before the file is written to disk. A subsequent post-save extension check is supposed to catch disallowed file types, but it fails to delete the file after it has already been saved, leaving the malicious payload accessible. Compounding this, the nonce normally required to reach the upload handler is leaked via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated attackers to harvest a valid nonce and fully bypass the gating mechanism. This results in a straightforward pre-auth RCE chain: obtain nonce → upload disguised executable (e.g., PHP webshell) → invoke uploaded file for code execution. Organizations running AI agent orchestration, RAG pipelines, or automation tooling on WordPress-adjacent infrastructure (e.g., internal wikis, ops dashboards, or agent-facing web portals built on WordPress) should treat this as agent-relevant, since RCE on a shared host can expose API keys, service credentials, and agent configuration files, or allow attackers to pivot into agent execution environments.

Affected Systems

ProSolution WP Client plugin for WordPress, all versions up to and including 2.0.10; any WordPress installation with this plugin active and the job portal shortcode rendered on a publicly accessible page

Indicators of Compromise

• No published hashes, IPs, or domains at time of disclosure
• Indicator pattern: unexpected files with executable extensions (.php, .phtml, .php5) in wp-content/uploads directories tied to ProSolution WP Client upload paths
• Suspicious POST requests to proSol_handleFileUpload endpoint with anomalous Content-Disposition filename headers

Remediation Steps

1. 1

   Update the plugin

   Upgrade ProSolution WP Client to a patched version beyond 2.0.10 as soon as it is released by the vendor; monitor the plugin changelog closely.

2. 2

   Disable or remove the plugin

   If no patch is available, deactivate and remove the ProSolution WP Client plugin, or disable the job portal shortcode on public-facing pages to prevent nonce leakage.

3. 3

   Audit uploads directory

   Scan wp-content/uploads and any plugin-specific upload directories for unexpected executable files (.php, .phtml, .cgi) and remove any unauthorized files found.

4. 4

   Implement WAF rules

   Deploy web application firewall rules to block requests with manipulated Content-Disposition headers or suspicious file extensions targeting the upload handler.

5. 5

   Restrict upload directory execution

   Configure the web server to deny PHP/script execution within uploads directories via .htaccess or equivalent server configuration.

6. 6

   Rotate credentials

   If compromise is suspected, rotate all API keys, database credentials, and service account secrets stored on or accessible from the affected host, including those used by any integrated automation or agent tooling.